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In the Claims 

Please amend the claims as follows: 

1 . (Currently amended) In a wireless data communications system wherein mobile units 
communicate with a computer using access points, and wherein said system operates according 
to a protocol specifying a format for data message packets and said data message packets contain 
state information for said mobile units, a method for detecting unauthorized access attempts to 
the system, comprising: 

forwarding one or more data packets received by said access points to a computer; m4 
maintaining a state table on said computer, said state table storing state information for 
said mobile units , the state information including at least a MAC address parameter, an 
authentication status parameter, and a further parameter unrelated to the MAC address parameter 
and the authentication status parameter ; and 

operating said computer to compare format and state information of said one or more 
received data packets to selected requirements of said protocol-specified format and said stored 
state information, and signaling an alert if said packets deviate from said protocol-specified 
format or said stored state information. 

2. (Original) A method as specified in claim 1 wherein said protocol-specified format 
includes a header message portion and wherein said comparing of format comprises comparing 
format of said header message portion to said protocol-specified format. 

3. (Canceled) 

4. (Currently amended) A method as specified in claim 2 wherein said protocol is one of 
IEEE Standarda 8 02:1 la/b/g a wireless protocol having a frame control field in said header 
message .portion and wherein said comparing of format comprises comparing format of said 
frame control field. 
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5. (Currently amended) A method as specified in claim 1 wherein s aid - protocol is one of 
IEEE Standards 8 02.1 la/b/g, and further w h e rein said one or more received data packets 
comprise IEEE Standard 802.1 la/b/g Management Frames. 

6. (Currently amended) A method as specified in claim 1 wherein said protocol is one of 
IEEE Standards 802 .1 l a/b/g, and further wherein said one or more received data packets 
comprise IEEB - Standard 8 02 . 1 la/b/g Control Frames. 

7. (Currently amended) A method as specified in claim 1 wherein said protocol is one of 
IEEE Standards 8 02.1 la/b/g, and furth e r whoroin said one or more received data packets 
comprise a first WEP flag. 

8. (Previously presented) A method as specified in claim 7 wherein said packets have a first 
WEP flag value which is inconsistent with a second WEP value stored in said state table on said 
computer. 

9. (Previously presented) A method as specified in claim 1 wherein said one or more 
received data packets comprise a first Protocol Version value which is inconsistent with a second 
Protocol Version value stored in said state table on said computer. 

1 0. (Original) A method as specified in claim 1 wherein said one or more received data 
packets comprise a source MAC address which is a multicast address. 

1 1 . (Original) A method as specified in claim 1 wherein said one or more received data 
packets comprise a source MAC address which is a broadcast address. 

12. (Currently amended) A method as specified in claim [[3]] 1 wherein said one or more 
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received data packets comprise a first Power Management state variable which is inconsistent 
with a second Power Management state variable value stored in said state table on said computer. 

13. (Currently amended) A method as specified in claim [[3]] 1 wherein the step of 
operating said computer further comprises checking a More Data field of said received data 
packets for a value of "1" and further monitoring said access points for a possible denial of 
service attack. 

14. (Currently amended) A method as specified in claim [[3]] I wherein said one or more 
received data packets comprise an unsupported Type value. 

15. (Currently amended) A method as specified in claim [[3]] i wherein said one or more 
received data packets comprise an unsupported SubType value. 

16. (Original) A method as specified in claim 1 wherein said one or more received data 
packets comprise a spoofed MAC address. 

1 7. (Currently amended) A method as specified in claim [[3]] I wherein said one or more 
received data packets comprise a frame of length which is inconsistent with said protocol- 
specified format. 

18. (Canceled) 

! 9. (Currently amended) In a wireless data communications system wherein mobile units 
communicate with a computer using access points, and wherein said system operates according 
to a protocol specifying a format for data message packets and said data message packets contain 
state information for said access points, a method for detecting unauthorized access attempts to 
the system, comprising: 
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forwarding one or more data packets received by said mobile units to a computer; and 
maintaining a state table on said computer, said state table storing state information for 
said access points , the state information including at least a MAC address parameter, an 
authentication status parameter, and a further parameter unrelated to the MAC address parameter 
and the authentication status parameter ; and 

operating said computer to compare format and state information of said one or more 
received data packets to selected requirements of said protocol-specified format and said stored 
state information, and signaling an alert if said packets deviate from said protocol -specified 
format or said stored state information. 

20. (Original) A method as specified in claim 19 wherein said protocol-specified format 
includes a header message portion and wherein said comparing of format comprises comparing 
format of said header message portion to said protocol-specified format. 

21. ; (Currently amended) A method as specified in claim 20 wherein said protocol is efte-ef * . --*>»-..■ 
IEEE Standards 802.1 l a/b/g a wireless protocol having a frame control field in said header < s,i« 
message portion and wherein said comparing of format comprises comparing format of said ; 

frame control field. 

22. (Currently amended) A method as specified in claim 19 wherein said protocol is on e of 
IEEE Standards 8 02.1 la/b/g, and furth e r wher e in said one or more received data packets 
comprise IEEE Standard 802.1 la/b/g Management Frames. 

23. (Currently amended) A method as specified in claim 19 wherein said protocol i s one of 
IEEE Standards 802.1 la/b/g, and further wh e r e in said one or more received data packets 
comprise IEEE Standard 802.1 la/b/g Control Frames. 

24. (Canceled) 
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25 . (Currently amended) A method as specified in claim 1 9 wherein said protocol is on e of 
IEEE Standards 802,1 la/b/g, an d f urther wherein said one or more received data packets 
comprise a first WEP flag. 

26. (Previously presented) A method as specified in claim 25 wherein said packets have a 
first WEP flag value which is inconsistent with a second WEP value stored in said state table on 
said computer. 

27. (Previously presented) A method as specified in claim 25 wherein said one or more 
received data packets comprise a first Protocol Version value which is inconsistent with a second 
Protocol Version value stored in said state table on said computer. 

28. (Currently amended) A method as specified in claim [[24]] 19 wherein said one or more 
received data packets comprise a source MAC address which is a multicast address. V . 

29. (Currently amended) A method as specified in claim [[24]] 19 wherein said one or more 
received data packets comprise a source MAC address which is a broadcast address. 

30. (Currently amended) A method as specified in claim [[24]] 19 wherein said one or more 
received data packets comprise a first Power Management state variable which is inconsistent 
with a second Power Management state variable value stored in said state table on said computer. 

3 1 . (Currently amended) A method as specified in claim [[24]] 19 wherein the step of 
operating said computer further comprises checking a More Data field of said received data 
packets for a value of "1" and further monitoring said access points for a possible denial of 
service attack. 
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32. (Currently amended) A method as specified in claim [[24]] J_9 wherein said one or more 
received data packets comprise an unsupported Type value. 

33. (Currently amended) A method as specified in claim [[24]] 19 wherein said one or more 
received data packets comprise an unsupported SubType value. 

34. (Currently amended) A method as specified in claim [[24]] 1_9 wherein said one or more 
received data packets comprise a spoofed MAC address. 

35. (Currently amended) A method as specified in claim [[24]] 19 wherein said one or more 
received data packets comprise a frame of length which is inconsistent with said protocol- 
specified format. 

36. (Canceled) 

37. (Canceled) 

38. (Canceled) 

39. (Canceled) 
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